Unscored severity · published Oct 28, 2026
CVE-2026-117619
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie,…
New
–
CVSS
–
EPSS
No
On KEV
Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jenkins · Jenkins
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117619
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117619
www.jenkins.io
https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4189
More from Jenkins
9.9
CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
9.9
CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
9.8
CVE-2024-23897
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
9.8
CVE-2018-1000861
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in…
9.8
CVE-2017-1000353
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution